Metadata-Version: 2.4
Name: rolesanywhere-onboard
Version: 1.0.0
Summary: Plug-and-play client for onboarding users against a self-hosted IAM Roles Anywhere Central CA
Author: Viresh Solanki
License: MIT
Project-URL: Homepage, https://github.com/vireshsolanki/iam-roles-anywhere-automation
Project-URL: Issues, https://github.com/vireshsolanki/iam-roles-anywhere-automation/issues
Keywords: aws,iam-roles-anywhere,certificate-authority,x509,pki
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Operating System :: POSIX :: Linux
Classifier: Operating System :: MacOS :: MacOS X
Classifier: Operating System :: Microsoft :: Windows
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.8
Description-Content-Type: text/markdown
Requires-Dist: cryptography>=41.0

# rolesanywhere-onboard

Plug-and-play client for onboarding users against a self-hosted [IAM Roles Anywhere Central CA](https://github.com/vireshsolanki/iam-roles-anywhere-automation).

Cross-platform (Linux, macOS, Windows) — the only non-stdlib dependency is
[`cryptography`](https://pypi.org/project/cryptography/) for local RSA
keypair generation (Python has no built-in asymmetric crypto, and this
avoids depending on a system `openssl` binary, which Windows doesn't ship
by default).

## Install

```bash
pip install rolesanywhere-onboard
```

## CLI

```bash
rolesanywhere-onboard --url <ApiEndpoint> --secret <ApiKeyValue> --name alice \
    --trust-anchor-arn <arn> --profile-arn <arn> --role-arn <arn> --days 365
```

Admin mode (uses your own AWS credentials instead of a shared API key):
```bash
rolesanywhere-onboard --lambda <IssuerFunctionName> --name alice \
    --trust-anchor-arn <arn> --profile-arn <arn> --role-arn <arn>
```

## As a library

```python
from rolesanywhere_onboard import request_certificate, get_credentials

result = request_certificate(url="...", secret="...", name="alice", days=365)
creds = get_credentials(result.cert_path, result.key_path,
                         trust_anchor_arn, profile_arn, role_arn)
# {"AccessKeyId": ..., "SecretAccessKey": ..., "SessionToken": ..., "Expiration": ...}
```

## Requirements

- Python 3.13+
- The `aws` CLI, but *only* if using `--lambda` (admin) mode — the public
  `--url`/`--secret` mode needs no AWS credentials or tooling at all.

## License

MIT
